FireKeepers Casino Hotel

FireKeepers Casino Hotel, the covered entity (CE), discovered that a vendor’s credentials were compromised which enabled an unauthorized individual to gain access to its computer system. This incident happened from September 7, 2014, through April 26, 2015 and affected 7,666 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, drivers’ license numbers, social security numbers, financial information, insurance information, and medical billing information. FireKeepers notified all affected individuals and the media. It terminated remote access to its computer system for vendors and strengthened its security measures for remote access. It also revised its policies and procedures regarding the privacy and security of PHI. All employees were re-trained. FireKeepers provided documentation to OCR of these corrective action steps.